Identity Provider (IdP)

An identity provider (IdP) is the central service that authenticates a user once and then vouches for their identity to every connected application — Okta, Microsoft Entra ID, Google Workspace, and Ping are the names most enterprises run. The IdP is what makes single sign-on possible: applications stop checking passwords themselves and instead trust a signed assertion from the provider. That consolidation is excellent security engineering and, at the same time, the reason the IdP has become the single most attacked door in the modern enterprise.

How it works

When a user opens an application, the app redirects them to the identity provider. The IdP checks for a valid session, prompts for login and multi-factor authentication if there is none, and then returns a cryptographically signed token — via standards such as SAML or OpenID Connect — asserting who the user is and what they may access. Policy lives in one place: MFA requirements, conditional access rules, device checks, and offboarding all take effect everywhere the moment they change at the IdP.

Attackers follow the architecture. Rather than phishing ten application passwords, they target the one credential that opens everything: precision phishing against the IdP login page, adversary-in-the-middle proxies that capture the session token after a successful MFA login, push bombing until a tired user approves, or a call to the help desk to have the IdP password and MFA factor reset — the playbook behind the help desk impersonation attacks that took down MGM and Clorox's support provider.

How to defend against it

Protect the IdP in proportion to what it opens. Require phishing-resistant MFA for IdP logins, starting with administrators; enable conditional access that challenges new devices, impossible travel, and anomalous sessions; and harden help-desk identity verification for any reset touching an IdP account, since the human reset path is the attacker's favorite bypass. Monitor for new MFA factor enrollments and token anomalies — a stolen session outlives the login page. And train the people in the loop: an unexpected MFA prompt or an unsolicited "IT" call about an account problem is an attack on the identity provider, whatever name appears on the screen.